Splunk Search

Filtering fields using a common field in two different sourcetypes

infotork
Explorer

fields in sourcetype1 --> A,B,C, txid ( always has a value)

fields in sourcetype2--> D,E,F, txid ( may occur value for some sources or may not)

Its clear that i have a common field ( txid) in two different sourcetypes  sourcetype1 and sourcetype2

Requirement:

I need to print  A,B from sourcetype1, in case i didnt find "txid" in  sourcetype2,  

Please help

Labels (5)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

How about

sourcetype=sourcetype1 OR sourcetype=sourcetype2
| stats values(A) as A values(B) as B values(sourcetype) as types by txid
| where mvcount(types)==1 AND isnull(mvfind(types,"sourcetype2"))
| table A B txid

 

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...